Privacy Policy
Last updated: [DATE]
ToolTrack is run by [BUSINESS LEGAL NAME] (NZBN [NUMBER]), [ADDRESS], New Zealand ("we", "us"). This policy explains how we handle personal information under the New Zealand Privacy Act 2020.
Who this applies to
Businesses ("customers") use ToolTrack to track their tools and materials and give access to their staff ("users"). When a customer invites its staff, we hold the staff members' information on the customer's behalf so the customer can run its business. Questions about how your employer uses ToolTrack can also go to your employer.
What we collect
- Account details: email address and password (stored encrypted, never visible to us).
- Profile: first and last name, date of birth, contact phone number, and optionally job title and an emergency contact's name and number.
- Activity: which items you take out and return, the job or site you enter, and the times.
- Return photos: photos you take of items when returning them.
- Messages you send us through "Chat with us".
- Billing: company name and billing email. Card details are handled by Stripe — we never see or store them.
- Technical data: basic logs (such as IP address and browser type) kept by our hosting providers for security.
Why we collect it
- To run the service: sign-in, showing who has which item, and keeping a history of check-outs and returns.
- So your employer can identify and contact staff using their equipment, including in an emergency.
- To provide support, bill customers, keep the service secure, and meet legal obligations.
We don't sell personal information or use it for advertising.
Who can see it
- Your company's admins can see your profile, your activity and your return photos.
- Other staff in your company can see who currently has an item and recent history (names, jobs, times).
- Other companies using ToolTrack cannot see anything about your company.
- Us — only when needed to provide support or run the service.
Where it's stored
We use these service providers, which store or process information outside New Zealand:
- Supabase — database, sign-in and photo storage (hosted in [Sydney, Australia]).
- Vercel — website hosting (servers in Sydney, Australia, and a global network).
- Stripe — payments (United States and other countries).
- [EMAIL PROVIDER, e.g. Resend] — sending invite and sign-in emails ([COUNTRY]).
We choose providers that protect information to standards comparable to the Privacy Act.
How long we keep it
We keep information while the company's account is active. If a customer closes its account, we delete its data within [90] days, except billing records we must keep for tax purposes (7 years). If an admin removes you from a company, your activity history stays with that company's records.
Your rights
You can ask to see or correct the personal information we hold about you. You can update your own profile at any time in the app (Me → Edit my details). To request a copy of your information, correction, or deletion of your account, contact our Privacy Officer at [PRIVACY EMAIL]. We'll respond within 20 working days.
If you're not happy with how we handle your request, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Security
Data is encrypted in transit and at rest. Each company's data is separated by database security rules. If a privacy breach is likely to cause serious harm, we'll notify the people affected and the Privacy Commissioner as the law requires.
Changes
We'll post updates here and let customers know about significant changes.
Contact
Privacy Officer, [BUSINESS LEGAL NAME] · [PRIVACY EMAIL] · [PHONE] · [ADDRESS]